Cherry Pick workflow (argoproj/argo-rollouts)

The Cherry Pick workflow from argoproj/argo-rollouts, explained and optimized by Latchkey.

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: argoproj/argo-rollouts.github/workflows/cherry-pick.ymlLicense Apache-2.0View source

What it does

This is the Cherry Pick workflow from the argoproj/argo-rollouts repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Cherry Pick

on:
  pull_request_target:
    branches:
      - master
    types: ["labeled", "closed"]

jobs:
  find-labels:
    name: Find Cherry Pick Labels
    if: |
      github.event.pull_request.merged == true && (
        (github.event.action == 'labeled' && startsWith(github.event.label.name, 'cherry-pick/')) ||
        (github.event.action == 'closed' && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick/'))
      )
    runs-on: ubuntu-24.04
    outputs:
      labels: ${{ steps.extract-labels.outputs.labels }}
    steps:
      - name: Extract cherry-pick labels
        id: extract-labels
        run: |
          if [[ "${{ github.event.action }}" == "labeled" ]]; then
            # Label was just added - use it directly
            LABEL_NAME="${{ github.event.label.name }}"
            VERSION="${LABEL_NAME#cherry-pick/}"
            CHERRY_PICK_DATA='[{"label":"'$LABEL_NAME'","version":"'$VERSION'"}]'
          else
            # PR was closed - find all cherry-pick labels
            CHERRY_PICK_DATA=$(echo '${{ toJSON(github.event.pull_request.labels) }}' | jq -c '[.[] | select(.name | startswith("cherry-pick/")) | {label: .name, version: (.name | sub("cherry-pick/"; ""))}]')
          fi

          echo "labels=$CHERRY_PICK_DATA" >> "$GITHUB_OUTPUT"
          echo "Found cherry-pick data: $CHERRY_PICK_DATA"

  cherry-pick:
    name: Cherry Pick
    needs: find-labels
    if: needs.find-labels.outputs.labels != '[]'
    strategy:
      matrix:
        include: ${{ fromJSON(needs.find-labels.outputs.labels) }}
      fail-fast: false
    uses: ./.github/workflows/cherry-pick-single.yml
    with:
      merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }}
      version_number: ${{ matrix.version }}
      pr_number: ${{ github.event.pull_request.number }}
      pr_title: ${{ github.event.pull_request.title }}
    secrets:
      CHERRYPICK_APP_ID: ${{ vars.CHERRYPICK_APP_ID }}
      CHERRYPICK_APP_PRIVATE_KEY: ${{ secrets.CHERRYPICK_APP_PRIVATE_KEY }}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Cherry Pick
 
on:
  pull_request_target:
    branches:
      - master
    types: ["labeled", "closed"]
 
jobs:
  find-labels:
    timeout-minutes: 30
    name: Find Cherry Pick Labels
    if: |
      github.event.pull_request.merged == true && (
        (github.event.action == 'labeled' && startsWith(github.event.label.name, 'cherry-pick/')) ||
        (github.event.action == 'closed' && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick/'))
      )
    runs-on: latchkey-small
    outputs:
      labels: ${{ steps.extract-labels.outputs.labels }}
    steps:
      - name: Extract cherry-pick labels
        id: extract-labels
        run: |
          if [[ "${{ github.event.action }}" == "labeled" ]]; then
            # Label was just added - use it directly
            LABEL_NAME="${{ github.event.label.name }}"
            VERSION="${LABEL_NAME#cherry-pick/}"
            CHERRY_PICK_DATA='[{"label":"'$LABEL_NAME'","version":"'$VERSION'"}]'
          else
            # PR was closed - find all cherry-pick labels
            CHERRY_PICK_DATA=$(echo '${{ toJSON(github.event.pull_request.labels) }}' | jq -c '[.[] | select(.name | startswith("cherry-pick/")) | {label: .name, version: (.name | sub("cherry-pick/"; ""))}]')
          fi
 
          echo "labels=$CHERRY_PICK_DATA" >> "$GITHUB_OUTPUT"
          echo "Found cherry-pick data: $CHERRY_PICK_DATA"
 
  cherry-pick:
    timeout-minutes: 30
    name: Cherry Pick
    needs: find-labels
    if: needs.find-labels.outputs.labels != '[]'
    strategy:
      matrix:
        include: ${{ fromJSON(needs.find-labels.outputs.labels) }}
      fail-fast: false
    uses: ./.github/workflows/cherry-pick-single.yml
    with:
      merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }}
      version_number: ${{ matrix.version }}
      pr_number: ${{ github.event.pull_request.number }}
      pr_title: ${{ github.event.pull_request.title }}
    secrets:
      CHERRYPICK_APP_ID: ${{ vars.CHERRYPICK_APP_ID }}
      CHERRYPICK_APP_PRIVATE_KEY: ${{ secrets.CHERRYPICK_APP_PRIVATE_KEY }}

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 2 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.